8Dflow Privacy Policy

1. Who we are

8Dflow is provided by:

8Dflow Pty Ltd
64A Burnett Street
Buderim QLD 4558
Australia
Email: legal@8dflow.com

In this Privacy Policy, “8Dflow,” “we,” “us,” and “our” refer to 8Dflow Pty Ltd.

“Services” means the 8Dflow software, applications, website, and related services we make available. Where the context refers to the product or service, references to “8Dflow” mean the Services.

2. Scope of this policy

This Privacy Policy covers personal information handled by 8Dflow in connection with:

• our public website;
• contact forms;
• demo or early-access requests;
• resource downloads;
• newsletter or marketing communications;
• account creation;
• use of the 8Dflow service;
• billing and subscription administration;
• support requests;
• product communications;
• security and operational activities.

This Privacy Policy does not apply to third-party websites, services, or tools that we do not control.

3. Privacy Collection Notice

For a short summary of what personal information we collect, why we collect it, who we may disclose it to, and what happens if you do not provide it, see our Privacy Collection Notice.

The Privacy Collection Notice is intended to provide collection-level privacy information for forms, signup, account use, support, resource requests, and other interactions with 8Dflow.

4. Our role and Customer role

For personal information we collect and use for our own business purposes, such as website operation, account administration, billing, security, product communications, support, marketing where permitted, and service improvement, 8Dflow generally determines the purposes and means of processing.

For Customer Data entered into 8Dflow by a Customer or User, the Customer generally decides what information is entered, who may access it, and how it is used in the Customer's workflows. Where 8Dflow processes Customer Personal Data on behalf of a Customer under applicable data protection laws, our Data Processing Addendum applies.

Nothing in this Privacy Policy transfers ownership of Customer Data. Ownership of Customer Data, completed reports, PDFs, exports, records, 8Dflow software, templates, workflows, formats, layouts, documentation, and other intellectual property is addressed in our Terms of Service.

5. Customer Data and personal information

Customers and Users may enter information into 8Dflow, including 8D reports, NCRs, SCARs, corrective actions, evidence, attachments, comments, owner assignments, approval records, due dates, and workflow history.

Some of that Customer Data may include personal information, such as names, email addresses, job titles, roles, comments, ownership assignments, approval records, activity history, supplier contacts, customer contacts, or information included in attachments.

For Customer Data, the Customer decides what information is entered into 8Dflow. Where 8Dflow processes personal data on behalf of a Customer, our Data Processing Addendum applies.

6. Personal information we collect

We may collect the following types of personal information.

Information you provide directly

This may include:

• name;
• email address;
• phone number, if provided;
• company name;
• job title or role;
• account details;
• billing contact details;
• support messages;
• contact form messages;
• demo or early-access request details;
• newsletter or resource request details;
• feedback, survey responses, or product comments;
• trial, subscription, cancellation, refund, or billing enquiry details;
• communications with us, including emails and form submissions.

Account and product information

When you use 8Dflow, we may collect:

• account profile information;
• organisation or workspace details;
• user roles and permissions;
• login and authentication information;
• product usage information;
• activity logs;
• feature usage;
• report, workflow, and record metadata;
• device, browser, and session information;
• IP address;
• error logs and diagnostic information;
• trial status;
• subscription status;
• plan type;
• billing administrator details;
• cancellation or downgrade status where applicable;
• workspace settings;
• audit, security, or operational logs where applicable.

Customer Data

Customer Data may include:

• 8D report content;
• NCR content;
• SCAR content;
• corrective-action records;
• containment records;
• evidence files;
• attachments;
• comments;
• user assignments;
• approval records;
• due dates;
• workflow history;
• exported reports or PDFs;
• supplier or customer contact details entered by Customers or Users;
• other information submitted to or created in 8Dflow by Customers or Users.

The exact Customer Data processed depends on what each Customer and User chooses to enter.

Billing and payment information

We may collect billing information needed to manage trials, paid subscriptions, invoices, payment status, taxes, refunds, credits, cancellations, downgrades, chargebacks, payment disputes, and account administration.

The standard 8Dflow trial does not require a credit card. If you choose a paid subscription, billing or payment information may be required.

When paid subscriptions are offered, Stripe processes billing and payment information under its own terms and privacy practices. 8Dflow does not intend to store full payment card numbers in the service.

We may keep billing, invoice, tax, refund, credit, payment-status, and subscription records as reasonably needed for legal, accounting, tax, fraud-prevention, dispute-resolution, and business-record purposes.

Support and troubleshooting information

When you contact support, we may collect and process information needed to understand, investigate, respond to, and resolve your request.

This may include:

• support messages;
• screenshots;
• files or examples you provide;
• error messages;
• browser and device information;
• technical logs;
• error logs;
• usage metadata;
• account details;
• limited Customer Data where reasonably needed for the support request or operational issue.

Please do not include payment card details, passwords, API keys, private keys, access tokens, seed phrases, production credentials, highly sensitive personal information, or unrelated confidential information in support requests.

Where a screenshot, file, report, export, or example is useful for troubleshooting, include only what is reasonably needed and redact unrelated personal, customer, supplier, commercial, or confidential information where practicable.

Website, cookies, and analytics information

When you visit our website, we may collect information such as:

• pages visited;
• links clicked;
• browser type;
• device type;
• approximate location inferred from IP address;
• referring website;
• date and time of visit;
• cookie or similar technology identifiers;
• analytics and performance information.

Our use of cookies and similar technologies is described in our Cookie Notice.

Where enabled, we use Google Analytics and Vercel Analytics on our public marketing website to understand website usage, referral sources, page performance, campaign performance, and interactions with marketing pages.

Google Analytics and Vercel Analytics may process information such as pages visited, device and browser information, approximate location, referral source, session information, and interactions with the public marketing website.

Neither Google Analytics nor Vercel Analytics is intended to run on authenticated 8Dflow product pages.

We do not intentionally send Customer Data to Google Analytics or Vercel Analytics. We do not intentionally send personal information, report content, NCR content, SCAR content, evidence, customer records, supplier records, uploaded files, file names, comments, approval records, workflow records, or other Customer Data to either analytics service.

AI-assisted feature information

8Dflow does not currently offer AI-assisted features. No AI provider currently processes Customer Data for an 8Dflow AI-assisted feature.

If AI-assisted features are offered in the future, we may process inputs, prompts, outputs, summaries, drafts, or related metadata to provide those features.

If AI-assisted features are offered, those features are designed as drafting and productivity aids only. They are not designed to determine root cause, make quality decisions, approve corrective actions, verify effectiveness, decide containment, determine product release, certify compliance, replace human review, or replace qualified quality, engineering, regulatory, legal, supplier-management, or product-safety judgement.

7. How we collect personal information

We may collect personal information:

• directly from you;
• when you complete website forms;
• when you create an account;
• when a Customer administrator invites you to use 8Dflow;
• when you use the service;
• when you contact support;
• when you subscribe to communications;
• when you download a resource;
• through cookies and similar technologies;
• from payment, authentication, analytics, support, security, or communication providers;
• from other Users or Customers who enter information into 8Dflow;
• when you start or manage a free trial;
• when you subscribe to a paid plan;
• when you cancel, downgrade, request a refund, or contact us about billing;
• when you provide screenshots, files, examples, logs, or other information for support;
• when we generate logs, diagnostics, or security events from use of the service.

8. Why we use personal information

We may use personal information to:

• provide 8Dflow;
• create and manage accounts;
• authenticate Users;
• provide and manage free trials;
• manage paid subscriptions, renewals, cancellations, downgrades, refunds, credits, taxes, invoices, payment disputes, and chargebacks;
• manage subscriptions, billing, invoices, and payment status;
• provide customer support;
• investigate support requests, bugs, errors, logs, and service issues;
• respond to enquiries;
• send service messages;
• send product, account, security, and administrative communications;
• operate, maintain, secure, and improve the service;
• troubleshoot errors;
• monitor service performance;
• prevent fraud, misuse, security threats, and unauthorised access;
• generate, maintain, and review security, operational, diagnostic, and fraud-prevention records;
• analyse website and product usage;
• develop and improve features;
• provide AI-assisted features, if available;
• manage early-access, demo, resource, or newsletter requests;
• send marketing communications where permitted;
• maintain business, accounting, tax, legal, and compliance records;
• enforce our Terms of Service and Acceptable Use Policy;
• comply with legal obligations;
• protect the rights, safety, and security of 8Dflow, Customers, Users, and third parties.

9. Legal bases for EU and UK users

Where EU, UK, or similar privacy laws apply, we rely on one or more legal bases to process personal information.

The legal bases may include the following.

Where we rely on legitimate interests, those interests may include operating, securing, supporting, improving, and communicating about 8Dflow, preventing fraud and misuse, managing billing and subscriptions, maintaining records, and protecting our rights and the rights of Customers, Users, and third parties.

Where we rely on consent, you may withdraw consent where applicable. Withdrawing consent does not affect processing that occurred before withdrawal.

10. Customer responsibilities

Customers are responsible for deciding what Customer Data is entered into 8Dflow.

Customers are responsible for:

• ensuring they have the right to upload, process, and share Customer Data through 8Dflow;
• providing any required privacy notices to Users, employees, contractors, suppliers, customers, and other individuals;
• obtaining any required consents or permissions;
• deciding which Users may access Customer Data;
• managing user permissions;
• ensuring Customer Data is accurate, appropriate, and limited to what is needed;
• responding to privacy requests from individuals where the Customer controls the relevant Customer Data;
• not submitting prohibited or unsupported data.

8Dflow is not responsible for a Customer’s internal privacy notices, legal basis, consent processes, data-entry practices, or decisions about what Customer Data to include in the service.

11. Prohibited and unsupported data

Customers and Users must comply with the Prohibited Data section of our Acceptable Use Policy. That section contains the primary list of data that must not be submitted to or stored in 8Dflow unless we expressly agree in writing.

Without limiting the Acceptable Use Policy, 8Dflow is not intended for highly regulated, highly sensitive, special category, export-controlled, classified, payment-card, or secret credential data unless we expressly support that use in writing.

You are responsible for determining whether Customer Data is appropriate for use with 8Dflow.

12. AI-assisted features and Customer Data

8Dflow does not currently offer AI-assisted features. No AI provider currently processes Customer Data for an 8Dflow AI-assisted feature.

If AI-assisted features are offered in the future, those features are designed as drafting and productivity aids only. You are responsible for reviewing, verifying, editing, and approving AI-assisted outputs before relying on them or sharing them.

Unless a future product feature, order form, Data Processing Addendum, or separate written agreement expressly states otherwise, 8Dflow does not use Customer Data to train third-party foundation models and does not permit third-party AI providers to use Customer Data to train their general models.

Unless a future product feature, order form, Data Processing Addendum, or separate written agreement expressly states otherwise, 8Dflow does not use Customer Data to train 8Dflow proprietary artificial-intelligence or machine-learning models.

This does not prevent 8Dflow from using aggregated or de-identified information to understand, operate, secure, support, and improve the Services, provided that information does not identify a Customer, User, individual, or confidential business information.

If AI-assisted features are offered and involve third-party providers, those providers may process inputs and outputs to provide the relevant feature. Material providers that process Customer Personal Data on behalf of 8Dflow may be listed in our Data Processing, Security & Subprocessors page.

If our AI-assisted features or data-use practices materially change, we will update this Privacy Policy and related legal pages where appropriate.

8Dflow is not designed to use personal information to make solely automated decisions that produce legal or similarly significant effects about individuals.

13. How we share personal information

We may share personal information with the following categories of recipients.

Customer administrators and Users

If you use 8Dflow through a Customer account, Customer administrators and authorised Users may be able to access information associated with your account and activity, depending on their permissions.

Service providers and subprocessors

We may share personal information with service providers that help us provide, host, secure, support, analyse, communicate about, or improve 8Dflow.

These may include providers for:

• cloud hosting, application delivery, and related technical services (currently Vercel);
• database hosting, authentication, and file storage (currently Supabase);
• transactional email, including early-access, service, and product communications (currently Resend);
• billing and payment processing (Stripe, when paid subscriptions are offered);
• public marketing website analytics (currently Google Analytics and Vercel Analytics);
• billing, invoicing, tax, refund, credit, chargeback, or subscription-management providers, where used;
• customer support;
• error monitoring;
• security monitoring;
• AI-assisted drafting or summarisation features, if used.

Material subprocessors for Customer Personal Data are described in our Data Processing, Security & Subprocessors page where available.

At Customer direction

We may share or process Customer Data according to Customer instructions, such as when Users export reports, generate PDFs, invite Users, share records, or use integrations.

Professional advisers

We may share information with accountants, lawyers, insurers, auditors, consultants, or other professional advisers where reasonably needed for our business operations.

Legal, safety, and enforcement reasons

We may disclose information where we reasonably believe it is necessary to:

• comply with law, court orders, regulators, or legal process;
• enforce our Terms of Service or Acceptable Use Policy;
• protect the rights, safety, and security of 8Dflow, Customers, Users, or third parties;
• investigate fraud, security issues, misuse, or unlawful activity.

Business transfers

If 8Dflow is involved in a merger, acquisition, financing, corporate reorganisation, sale of assets, or similar transaction, personal information may be disclosed or transferred as part of that transaction, subject to appropriate confidentiality and legal protections.

14. No sale of Customer Data

8Dflow does not sell Customer Data.

8Dflow does not use Customer Data for third-party advertising.

8Dflow does not intentionally send Customer Data to Google Analytics or Vercel Analytics.

8Dflow does not use Customer Data to train third-party foundation models unless a product feature, order form, Data Processing Addendum, or separate written agreement expressly states otherwise.

Unless a product feature, order form, Data Processing Addendum, or separate written agreement expressly states otherwise, 8Dflow does not use Customer Data to train 8Dflow proprietary artificial-intelligence or machine-learning models.

We may use aggregated or de-identified information to understand, operate, secure, support, and improve the Services, provided it does not identify a Customer, User, individual, or confidential business information.

15. International disclosures and transfers

8Dflow is based in Australia.

Personal information may be processed in countries outside Australia by 8Dflow, our personnel, or our service providers.

These countries may have privacy and data protection laws that differ from the laws in your country.

Where required by applicable law, we will use appropriate safeguards or lawful transfer mechanisms for international transfers of personal information.

Where we transfer personal information from the EEA, UK, or Switzerland to a country that does not have an applicable adequacy decision, we rely on appropriate safeguards where required, which may include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or UK International Data Transfer Agreement, and Swiss adaptations or equivalent Swiss transfer mechanisms, as applicable.

Details of transfer mechanisms for Customer Personal Data are described in our Data Processing, Security & Subprocessors page where applicable.

The primary Supabase database, authentication, and storage project is hosted in Sydney, Australia.

Vercel may process application-delivery, request, deployment, and technical-log information in the United States and other countries where Vercel or its subprocessors operate.

Resend stores or processes relevant email-service data in the United States.

Stripe may process billing and payment information in the United States and other countries where Stripe or its service providers operate.

Google Analytics and Vercel Analytics may process public marketing-site analytics information in the United States and other countries where their providers or subprocessors operate.

Where practicable, we will identify material subprocessors and relevant countries or regions in our Data Processing, Security & Subprocessors page.

16. EU and UK representatives

If applicable data protection law requires 8Dflow to appoint an EU or UK representative, we will publish the representative’s contact details here or otherwise make them available as required by law.

Until those details are published, privacy requests can be sent to legal@8dflow.com.

17. Security

8Dflow uses reasonable technical and organisational safeguards designed to protect personal information against unauthorised access, loss, misuse, disclosure, alteration, and destruction.

Measures may include, as applicable to the service:

• access controls;
• authentication controls;
• role-based access controls where available;
• encryption in transit;
• reasonable protections for data storage;
• logging and monitoring;
• backup and recovery processes;
• vulnerability management appropriate to the stage and nature of the service;
• confidentiality obligations for personnel;
• vendor review;
• incident response procedures;
• data deletion or return processes.

No online service can guarantee complete security.

Customers and Users are responsible for managing their own users, permissions, devices, networks, passwords, authentication practices, exports, and internal security procedures.

You should not submit passwords, private keys, API keys, access tokens, seed phrases, production credentials, or similar secrets to 8Dflow unless we expressly support that use in writing.

18. Security incidents

If we confirm a Security Incident involving Customer Data or personal information under 8Dflow’s control, we will notify affected Customers or individuals as required by applicable law, our Terms of Service, and our Data Processing Addendum.

Where the Australian Notifiable Data Breaches scheme applies, we will assess whether a data breach is likely to result in serious harm and notify affected individuals and the Office of the Australian Information Commissioner where required by law.

Our notice may include, where reasonably available:

• a description of the incident;
• the categories of information involved;
• steps we have taken or plan to take;
• steps we recommend you take;
• a contact point for follow-up.

For Customer Personal Data that we process on behalf of a Customer, breach notification and assistance obligations are also addressed in our Data Processing Addendum.

We are not required to notify you of unsuccessful security attempts, routine security events, or events that do not affect personal information or Customer Data.

19. Retention

We keep personal information for as long as reasonably needed for the purposes described in this Privacy Policy.

Retention periods may depend on:

• the type of information;
• whether an account or subscription is active;
• Customer instructions;
• legal, tax, accounting, or reporting obligations;
• security and fraud-prevention needs;
• dispute resolution;
• backup and disaster recovery processes;
• whether information is needed to provide the service.

During an active paid subscription, Customers may export only Customer Data made available through the export features included in their plan. Not all Customer Data, attachments, workflow history, system information, logs, metadata, or configuration may be exportable.

Customers must export any needed available Customer Data before the paid subscription period ends.

When the paid subscription period ends following termination or cancellation, access to Customer Data may be limited or disabled. No general 30-day post-termination export period is promised for paid subscriptions. Trial or free-plan data may still be deleted or disabled after 30 days as described in the Terms.

8Dflow may delete or disable access to Customer Data after the subscription ends, subject to backup retention, legal obligations, security requirements, dispute resolution, and legitimate business recordkeeping.

Backups may persist for a limited period before deletion in accordance with 8Dflow’s backup and retention practices.

For paid subscriptions, billing, tax, invoice, refund, credit, payment dispute, chargeback, and accounting records may be retained for as long as reasonably needed for legal, tax, accounting, fraud-prevention, dispute-resolution, and business-record purposes.

Support records, screenshots, logs, and diagnostic information may be retained for as long as reasonably needed to provide support, maintain security, troubleshoot issues, improve the service, handle disputes, and comply with legal obligations.

20. Your privacy choices

Depending on your location and the information involved, you may have rights to:

• request access to personal information;
• request correction of personal information;
• request deletion of personal information;
• object to or restrict certain processing;
• request portability of certain personal information;
• withdraw consent where processing is based on consent;
• opt out of marketing communications;
• lodge a complaint with a privacy regulator.

These rights may be subject to legal limits and exceptions.

To make a privacy request, contact legal@8dflow.com. We may need to verify your identity and authority before responding. We will respond within the time required by applicable law.

If your request relates to Customer Data controlled by one of our Customers, we may direct you to that Customer. Where required by applicable law and our Data Processing Addendum, we will provide reasonable assistance to the Customer.

21. Access and correction

You may request access to personal information we hold about you.

You may also ask us to correct personal information if you believe it is inaccurate, incomplete, or out of date.

We may need to verify your identity before responding.

If the information is part of Customer Data controlled by a Customer, the Customer may be responsible for responding to your request.

If we refuse an access or correction request where permitted by law, we will take reasonable steps to explain why, subject to any legal limits.

22. Marketing communications

We may send marketing communications where permitted by law.

Where Australian electronic marketing laws apply, commercial electronic messages will be sent only where we have express consent, inferred consent, or another permitted basis, and will include sender identification and an unsubscribe method where required.

You can unsubscribe from marketing emails using the unsubscribe link in the email or by contacting us at legal@8dflow.com.

Even if you opt out of marketing communications, we may still send service, account, billing, security, and administrative messages.

We do not sell Customer Data for marketing.

We do not use Customer Data for third-party advertising.

23. Cookies and similar technologies

We may use cookies and similar technologies to operate our website and service, remember preferences, understand website usage, improve performance, and support analytics or marketing where permitted.

Some cookies are necessary for the website or service to function. Other cookies may be optional or subject to your preferences, depending on applicable law.

More information is provided in our Cookie Notice.

24. Automated decision-making

If AI-assisted features are offered, those features are designed as drafting and productivity aids only.

8Dflow is not designed to use personal information to make solely automated decisions that produce legal or similarly significant effects about individuals.

Customers remain responsible for human review, quality decisions, engineering decisions, product-safety decisions, approval decisions, release decisions, supplier communications, customer communications, and compliance decisions.

If 8Dflow introduces automated decision-making features that materially affect individuals’ rights or interests, we will update this Privacy Policy where required by applicable law.

25. Children

8Dflow is intended for business use.

It is not directed to children and is not intended for use by individuals under 16.

We do not knowingly collect personal information from children through 8Dflow. If you believe a child has provided personal information to us, contact legal@8dflow.com.

26. Complaints

If you have a privacy concern or complaint, contact us at legal@8dflow.com.

Please include enough detail for us to understand and review your concern.

We will take reasonable steps to investigate and respond within a reasonable time.

If you are not satisfied with our response, you may have the right to contact your local privacy regulator. In Australia, this may include the Office of the Australian Information Commissioner.

27. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we will take reasonable steps to notify affected users where appropriate, such as by posting an updated version on our website, sending an email, or providing an in-product notice.

The updated Privacy Policy will apply from the effective date stated on the updated page.

If a change materially affects how we handle Customer Data or Customer Personal Data, we will take reasonable steps to notify affected Customers where appropriate.

28. Contact

Questions, privacy requests, or complaints can be sent to:

8Dflow Pty Ltd
64A Burnett Street
Buderim QLD 4558
Australia
Email: legal@8dflow.com